Data processing
Last updated 10 October 2026
This is a draft. It describes accurately what the software does with data and money. It has not been reviewed by a lawyer, and nothing here should be read as a claim that Kyrovane is compliant with the law of any particular country until that review has happened.
Not yet a signed agreement
This page describes how Kyrovane processes personal data on its customers’ behalf and what a data processing agreement with Kyrovane will cover. A signed agreement is not available yet: it needs the legal entity and a legal review that have not happened. If your organisation needs one before using Kyrovane, write to legal@kyrovane.com and we will tell you plainly where it stands.
Roles
For the personal data an agency or brand puts into Kyrovane (creators, clients’ people, messages), the customer decides what is collected and why, and Kyrovane processes it on the customer’s instructions. For the data about the customer’s own account (its users, billing), Kyrovane decides, and the privacy notice applies.
Instructions and purpose
Kyrovane processes customer data to run the service the customer uses and for nothing else: no selling, no advertising, no training of AI models. Using the product is how the customer gives its instructions; anything beyond that needs the customer’s agreement.
Security
- Every customer’s rows are separated in the database itself (row-level security), and tests attempt the crossing on every part of the product.
- Passwords are hashed (Argon2id); tokens are stored only as digests; platform credentials and second factors are encrypted at rest; traffic is encrypted in transit; the browser never holds an API token.
- People in the customer’s team see only what their role and assigned brands allow; significant actions are written to an audit trail that cannot be edited.
- The security page describes each control, and what has not been independently tested.
Sub-processors
The services Kyrovane relies on, what each receives, and which are not yet confirmed for production are listed on the sub-processors page. Changes are announced there before they take effect.
What a signed agreement will cover
- the subject, duration, nature and purpose of the processing, and the kinds of data and people;
- processing only on documented instructions, and confidentiality for everyone with access;
- the security measures above, kept current;
- sub-processors on the same terms, with notice of changes and a way to object;
- help with the customer’s obligations to the people the data is about;
- notice of a personal data breach, without undue delay;
- return or deletion of the data at the end of the service;
- the information needed to show these terms are kept.
Where the data leaves the country it was collected in, the agreement will say where it goes and on what basis, once the production hosting region is confirmed.